Terms of Service

These Terms of Service ("Terms") govern your use of Spilla, an anonymous micro-story service operated at https://spilla.app and via our mobile app (together, the "Service"). By creating a Spilla profile or using the Service in any way, you agree to be bound by these Terms. If you do not agree, do not use the Service.

Spilla is run by two people, not a corporation. If you have a problem, the founders read every message sent to hello@spilla.app.

Table of contents

1. Who can use Spilla
2. Your account and recovery code
3. Acceptable use and content rules
4. How moderation works
5. Your content and the licence you grant us
6. Spilla Premium and subscriptions
7. Push notifications
8. Advertising and promotional content
9. Drafts and scheduled posts
10. Our intellectual property
11. Copyright takedown (DMCA)
12. Termination
13. Disclaimers
14. Limitation of liability
15. Indemnification
16. Changes to these Terms
17. Governing law and disputes
18. Contact

1. Who can use Spilla

You must be at least 16 years old to use Spilla. If the age of digital consent in your country is higher than 16, that higher age applies. We do not knowingly allow children under that age to use the Service.

Spilla is offered "as is" globally, but if your local law makes any of these Terms unenforceable or if Spilla is not lawful where you live, you are responsible for not using the Service.

2. Your account and recovery code

You sign in with a one-time code sent by SMS to your phone. We show other users only a generated handle (for example red-fox-2143) — your phone number is never visible to them.

When you first create a profile, Spilla generates a 26-character recovery code. Save it offline (on paper, in a password manager, or on a secure note). The code is the only way to recover your profile from a new device. We store only a cryptographic hash of the code and cannot help you recover it if you lose it. Losing the code means losing access to that profile.

You are responsible for activity that happens through your profile. If you believe someone else has gained access to it, email security@spilla.app immediately and a moderator will reset the profile's recovery code.

3. Acceptable use and content rules

Spilla is for honest, anonymous stories from everyday life. The Service is not for and you will not post:

• Content that sexualises or endangers minors, or any sexually explicit content at all.
• Content that threatens, harasses, stalks, doxxes, or incites violence against a specific person or group.
• Hate speech targeting protected characteristics (race, ethnicity, religion, gender identity, sexual orientation, disability, national origin, age).
• Content that promotes self-harm, suicide, or eating disorders.
• Personal information of identifiable third parties without their consent.
• Spam, advertising, link farms, automated posting, or content designed to manipulate the feed.
• Content that infringes someone else's copyright, trademark, or other rights.
• Illegal content under the laws that apply where you are or where Spilla operates.
• Content generated wholly or substantially by a language model or other AI system. Spilla is a human-stories platform.

You must also not abuse the Service itself: no scraping, no probing for security vulnerabilities without first contacting us, no circumventing moderation, no creating new profiles after a ban.

SMS sign-in codes. Sign-in to Spilla is by one-time SMS code sent to the phone number you enter. Spilla's SMS messages are strictly transactional: we only send a message when you initiate a sign-in or recovery action, and we never send marketing, promotional, or re-engagement messages by SMS. If you do not want to receive any further sign-in codes you can reply STOP to any Spilla SMS — Twilio (our SMS provider) will add your number to the opt-out list and silently drop any future Spilla SMS to that number. After opting out, you will not be able to receive a sign-in code at that number, so plan to use the generational-fork recovery code (see section 2) if you need to sign back in.

4. How moderation works

Every story and comment is checked by an AI content classifier on submission. The classifier flags policy violations; a human moderator reviews flagged items and takes one of these actions:

• Publish — content is allowed and visible in the feed.
• Hide — content is removed from the feed and other users' views, but the author still sees it with a "hidden" badge.
• Remove — content is permanently deleted; even the author no longer sees it.

Repeated violations may result in a phone-level ban that prevents new profiles being created from your phone number. Bans for unambiguous violations (child safety, threats of violence, doxxing) are final and immediate.

If you believe an action was wrong, email appeals@spilla.app from the phone number on file. Appeals are read by the founders.

5. Your content and the licence you grant us

You own what you post. By posting on Spilla you grant us a worldwide, non-exclusive, royalty-free licence to host, store, transmit, display, reformat, and (for moderation purposes only) analyse your content to operate the Service. The licence ends when you delete the content or your profile, except where we must keep the content briefly in backups (we do not restore from backups to revive deleted content).

We do not use your content to train AI models. We do not sell or licence your content to third parties.

6. Spilla Premium and subscriptions

Spilla offers an optional paid tier called Spilla Premium. Premium unlocks a longer story body (up to 500 characters instead of 280), unlimited favourites and saves (free accounts are capped at 20 of each), drafts and scheduled posting, and visibility into which other users reacted to your stories. The specific feature list and pricing in effect from time to time are shown on our Premium page; the version shown there at the moment you subscribe is the version that applies to your subscription.

Subscription prices, as of the date at the top of this page, are EUR 4.99 per month or EUR 39 per year. Prices are inclusive of any applicable consumption taxes that Stripe collects on Spilla's behalf for your jurisdiction.

How billing works. Spilla Premium is sold through two billing surfaces, and the one that applies to you depends on where you subscribed.

• Web (Stripe). If you subscribe at spilla.app/premiumon the web, all payments are processed by Stripe. When you click Subscribe, Spilla sends Stripe an opaque alias (a synthetic email of the form {profile-uuid}@spilla.app) and your profile id; you complete the rest of checkout on Stripe's hosted page. Spilla never sees or stores your card number, the email you may enter into Stripe's form, or your billing address.
• Mobile (Apple App Store / Google Play Billing via RevenueCat). If you subscribe through the Spilla iOS or Android app, Apple or Google processes the payment through their own billing systems (using your Apple ID or Google account on file). RevenueCat reads the resulting billing receipts on Spilla's behalf and reports the subscription's entitlement status to us. We send RevenueCat only your Spilla profile UUID (as their app_user_id) and the chosen product identifier. Spilla never sees your Apple ID, Google account, card details, or billing address.

Auto-renewal. Spilla Premium auto-renews each billing period (monthly or annual, matching what you chose at checkout) until you cancel. The platform that processes your subscription will attempt to charge the payment method on file on each renewal date. If the charge fails, your Premium grant remains active for a short grace period during which the platform retries; if the retries do not succeed, Premium expires and your account returns to the free tier.

How to cancel. Where you cancel depends on where you subscribed.

• Web subscriptions: cancel any time from the Stripe-hosted Customer Portal, linked from your in-app profile.
• iOS subscriptions: Settings → tap your Apple ID name → Subscriptions → Spilla → Cancel. Spilla cannot cancel an iOS in-app subscription on your behalf — Apple owns that flow.
• Android subscriptions:Play Store → tap your profile photo → Payments & subscriptions → Subscriptions → Spilla → Cancel. Spilla cannot cancel a Play Store subscription on your behalf — Google owns that flow.

In every case cancellation takes effect at the end of the billing period that's already paid for; Premium features remain available until then.

Refunds. Spilla does not offer pro-rated refunds for partial billing periods.

• Web subscriptions: if you believe a charge was made in error or you have an exceptional situation, contact billing@spilla.app. Refunds, where granted, are issued at Spilla's discretion via the Stripe Dashboard.
• Mobile subscriptions: refund requests for iOS or Android in-app subscriptions are subject to Apple's or Google's own refund policy. Spilla cannot issue or block a platform-issued refund and cannot pre-approve refund requests on the platforms' behalf.

Price changes. Spilla may change the subscription price for future renewals with at least 30 days' notice via the in-app banner.

• Web subscriptions: where Stripe is able to reach you because you provided an email at checkout, you will also receive notice by email to the billing address on your Stripe customer record. If you do not agree to the new price you can cancel before it takes effect.
• Mobile subscriptions: Apple and Google handle the consent flow for price changes on their own platforms. You will be asked through the App Store or Play Store to accept the new price before it takes effect; if you decline, your subscription auto-cancels at the end of the current period.

EU right of withdrawal. If you are an EU consumer, you would normally have a 14-day right of withdrawal under the EU Consumer Rights Directive. Because Spilla Premium is digital content that is delivered to you immediately on a successful checkout (your Premium features unlock the moment the payment is confirmed), by clicking Subscribe you expressly request immediate performance and acknowledge that you lose the right of withdrawal once that performance begins. Stripe's hosted checkout surfaces this disclosure as part of the standard Stripe legal text.

Termination of a Premium grant for cause. If we terminate your account for a violation of these Terms (see section 10), any unused portion of a prepaid subscription is forfeit and your Premium grant ends with the account.

7. Push notifications

If you have the Spilla iOS or Android app installed and you grant the OS notification permission, Spilla will send you push notifications when someone reacts to or comments on one of your own stories. Push notifications are optional; declining or revoking the permission does not affect any other Spilla feature.

How delivery works. Our server queues a notification payload (trigger type, an optional snippet of the related content, and a navigation hint to the relevant story) and forwards it to Expo's Push Service. Expo forwards the payload to Apple Push Notification Service or Firebase Cloud Messaging, which delivers it to your device. Delivery is best-effort: a drop at any of those hops means you will not see the notification, and Spilla will not retry beyond Expo's own retry envelope.

What you can do. You can revoke the permission at any time from your device's OS Settings (Settings → Notifications → Spilla on iOS; Settings → Apps → Spilla → Notifications on Android). You can also stop notifications for a specific device by signing out of the Spilla app on that device — we delete the push token row when you sign out so future notifications for your profile no longer go to that device.

What we will not do. We will not send push notifications for marketing, promotional offers, re-engagement campaigns, or any other purpose beyond the reactions / comments use case described above. Spilla's notifications are transactional only.

8. Advertising and promotional content

Free-tier users (users without an active Premium subscription) see in-house promotional cards interspersed in the Spilla feed. These cards promote Spilla Premium and only Spilla Premium.

There is no third-party advertising network on Spilla, no tracking pixel, no behavioural targeting, no cross-site cookie, and no monetary exchange for the ad slot itself — the only goal of the in-feed card is to convert a free user to Premium. The card is rendered locally on your device based on your own Premium status; we do not log when a card was shown to you, we do not track whether you clicked it, and no data leaves your device for ad-attribution purposes.

Premium subscribers see no promotional cards in the feed.

9. Drafts and scheduled posts

Premium subscribers can save unpublished drafts and schedule a draft to publish at a chosen future time. Drafts are stored on Spilla's database under your profile, are protected by Postgres Row-Level Security so only you (and Spilla's automated scheduled-publish system) can read them, and are deleted from the database when you publish or delete them.

Scheduling is best-effort. The scheduler runs on a periodic interval (currently every minute). Your scheduled post will publish at, or shortly after, the time you chose — typically within a minute of the scheduled time. Spilla does not guarantee exact-second timing.

Scheduled drafts still pass through moderation. When the scheduler publishes a draft, the resulting story goes through the same AI classifier + human review pipeline as any other post (section 4). A draft that auto-publishes and is then flagged by moderation is held in the same pending state as a manually-submitted post.

If your Premium subscription ends while you still have unpublished drafts: existing draft rows are not deleted automatically, but new drafts cannot be saved, and scheduled drafts will not publish unless they are due during a future Premium period. You can still publish a draft immediately if it is within the free-tier body limit.

10. Our intellectual property

The Spilla name, logo, design, and the software that runs the Service belong to us. You may not copy, modify, redistribute, or reverse-engineer the Service except as expressly permitted by these Terms or by law.

11. Copyright takedown (DMCA)

If you believe content on Spilla infringes your copyright, send a notice to dmca@spilla.app with:

• A description of the work you say is infringed.
• A URL or other identifier pointing to the infringing content on Spilla.
• Your contact information.
• A statement, under penalty of perjury, that you have a good-faith belief the use is not authorised by the copyright owner, its agent, or the law.
• An electronic or physical signature.

We may also receive counter-notices. False notices have legal consequences in many jurisdictions; do not send one without checking with a lawyer.

12. Termination

You can delete your profile at any time from the in-app profile page. Deletion removes your stories, comments, reactions, and saved items; the salted hash of your phone number is kept only as long as another profile linked to it exists.

We may suspend or terminate your access to the Service at any time if you violate these Terms or if continuing to provide the Service to you would put other users at risk. Where the violation is not severe, we will try to explain what happened and give you a chance to respond before terminating.

13. Disclaimers

Spilla is provided "as is" and "as available". We do not warrant that the Service will be uninterrupted, error-free, secure against every possible attack, or that any particular content will be available at any particular time. To the maximum extent allowed by law, we disclaim all implied warranties including fitness for a particular purpose, merchantability, and non-infringement.

14. Limitation of liability

To the maximum extent allowed by law, Spilla and its founders will not be liable to you for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, data, use, or goodwill, arising out of or related to your use of (or inability to use) the Service. Our total aggregate liability for any direct damages will not exceed the greater of (a) the amount you paid us in the twelve months before the claim, or (b) one hundred euros (€100). Spilla is free to use today, so in practice (a) is zero.

Some jurisdictions do not allow these limits. Where that's the case, this section applies to the maximum extent permitted by your local law.

15. Indemnification

You agree to indemnify and hold us harmless from any claim, liability, damage, loss, or expense (including reasonable lawyers' fees) arising out of your use of the Service in breach of these Terms, your content, or your violation of someone else's rights.

16. Changes to these Terms

We may update these Terms when we change how the Service works or when the law requires it. For material changes, we will update the "Last updated" date at the top, post a notice in-app on your next sign-in, and give you at least 30 days' advance notice before the change takes effect. Continuing to use the Service after a material change has taken effect means you accept the new Terms.

Because Spilla's anonymity-by-design model means we do not collect end-user email addresses, the in-app notice on your next sign-in is the canonical channel through which you will see any update; the current published version of these Terms is always available at spilla.app/terms.

The following kinds of update take effect immediately on publication without the 30-day advance notice, because they cannot wait or because their nature is to clarify rather than change:

• New functionality. When we ship a new feature, the disclosure has to be live the moment the feature is live; you cannot meaningfully review a 30-day-advance notice about a feature that does not yet exist.
• Security updates. If a change is security-relevant — closing a vulnerability, tightening an authentication path, clarifying a moderation rule that is being abused — it takes effect immediately.
• Bug fixes. Typo corrections, broken-link repairs, restructuring for clarity, and similar non-substantive edits do not require advance notice.
• A court order. If a court orders an immediate change, we cannot delay it by 30 days; we will publish the order's required change as soon as we have implemented it and will say so in the Terms.
• Changes required by a third-party processor (Stripe, Apple, Google, RevenueCat, Twilio, Expo, Supabase) to maintain integration. We pass these through immediately because we do not control the upstream timeline and the platforms require pass-through.

17. Governing law and disputes

These Terms are governed by the laws of the jurisdiction where Spilla's operating entity is registered. Disputes will be resolved in the courts of that jurisdiction, except where mandatory consumer-protection law in your country gives you a different forum. The operating entity and exact jurisdiction will be confirmed in the next update of these Terms; until then, contact us first and we will work in good faith to resolve any complaint informally.

18. Contact

General questions: hello@spilla.app
Privacy: privacy@spilla.app
Security reports: security@spilla.app
DMCA: dmca@spilla.app
Appeals: appeals@spilla.app